[jammycakes]

Just a thought here. As far as I can tell, many bona fide security researchers seem to be independent consultants. Would they be less at risk of prosecution if they were handling sensitive data such as user names and passwords under the coverage of universities and/or similar accredited institutions operating under protocols as to who can and cannot access the data?

It would probably be more security theatre than actual security, but I'd imagine that it would at least keep the FBI happy.